CVE-2026-123602

EUVD-2026-119361

08.11.2026, 02:16

The Hickory DNS recursor in all versions of hickory-recursor and in hickory-resolver 0.26.0-beta.1 before 0.26.2 (recursor feature) is vulnerable to ghost domain names attacks because it reuses child-side apex NS RRsets cached from zone NS queries for iterative resolution. By repeatedly querying a zone's NS records, an attacker keeps the stale RRset cached indefinitely, letting name servers whose delegation the parent revoked keep answering for the zone.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	5.9 MEDIUM	NETWORK	HIGH	NONE	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: 19.62%

Debian Releases

Debian Product

Codename

rust-hickory-recursor

forky	vulnerable
sid	vulnerable
trixie	vulnerable

rust-hickory-resolver

forky	0.26.3-1 fixed
sid	0.26.3-1 fixed
trixie	vulnerable

Common Weakness Enumeration

CWE-672 - Operation on a Resource after Expiration or Release
The software uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.

References

https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-2hxp-x833-73f7

https://www.vulncheck.com/advisories/hickory-dns-recursor-ghost-domain-attack-via-child-side-ns-rrset-caching